setup.php

<?php
$config_path = __DIR__ . '/config.json';
$demo_mode = file_exists(__DIR__ . '/.demo');

// Automatically migrate the legacy config format.
if (file_exists($config_path)) {
    $existing = json_decode(file_get_contents($config_path), true);
    if (is_array($existing)) {
        if (isset($existing['epg_url']) && !isset($existing['epg_sources'])) {
            $existing['epg_sources'] = [[
                'name'    => 'Main',
                'epg_url' => $existing['epg_url'],
                'm3u_url' => $existing['m3u_url'] ?? '',
            ]];
            $existing['allow_personal_epg'] = false;
            unset($existing['epg_url'], $existing['m3u_url']);
            file_put_contents($config_path, json_encode($existing, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
        }
        // Bootstrap an admin key for older configs that do not have one yet.
        if (empty($existing['admin_key'])) {
            $existing['admin_key'] = bin2hex(random_bytes(16));
            file_put_contents($config_path, json_encode($existing, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
        }
    }
}

$is_first_setup = !file_exists($config_path);
$existing       = [];
$corrupt_config = false;
if (!$is_first_setup) {
    $existing = json_decode(file_get_contents($config_path), true);
    if (!is_array($existing)) {
        $existing       = [];
        $corrupt_config = true;
        $is_first_setup = true;
    }
}
$admin_key      = $existing['admin_key'] ?? null;

$mode    = 'setup';
$error   = '';
$new_key = '';

if (!$is_first_setup) {
    if ($demo_mode) {
        $mode = 'setup';
    } elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['admin_key_input'])) {
        if (trim($_POST['admin_key_input']) === $admin_key) {
            $mode = 'setup';
        } else {
            $mode  = 'lock';
            $error = 'Invalid admin key.';
        }
    } elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['group_name'])) {
        if (trim($_POST['admin_key_hidden'] ?? '') !== $admin_key) {
            $mode  = 'lock';
            $error = 'Invalid admin key.';
        } else {
            $mode = 'setup';
        }
    } else {
        $mode = 'lock';
    }
}

if ($mode === 'setup' && $_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['group_name'])) {
    if ($demo_mode) {
        $error = 'Demo mode is enabled. Configuration is read-only on this instance.';
    } else {
    $group_name         = trim($_POST['group_name'] ?? '');
    $allow_personal_epg = isset($_POST['allow_personal_epg']);
    $allow_personal_m3u = $allow_personal_epg && isset($_POST['allow_personal_m3u']);

    $names    = $_POST['source_name']    ?? [];
    $epg_urls = $_POST['source_epg_url'] ?? [];
    $m3u_urls = $_POST['source_m3u_url'] ?? [];

    $epg_sources = [];
    foreach ($names as $i => $name) {
        $epg_url = trim($epg_urls[$i] ?? '');
        $m3u_url = trim($m3u_urls[$i] ?? '');
        if (empty($epg_url)) continue;
        if (!filter_var($epg_url, FILTER_VALIDATE_URL)) {
            $error = "Invalid EPG URL for source \"$name\"."; break;
        }
        if (!empty($m3u_url) && !filter_var($m3u_url, FILTER_VALIDATE_URL)) {
            $error = "Invalid M3U URL for source \"$name\"."; break;
        }
        $epg_sources[] = [
            'name'    => trim($name) ?: 'Source ' . ($i + 1),
            'epg_url' => $epg_url,
            'm3u_url' => $m3u_url,
        ];
    }

    if (empty($error)) {
        if (empty($group_name)) {
            $error = 'Group name is required.';
        } elseif (empty($epg_sources)) {
            $error = 'At least one EPG source is required.';
        } else {
            $new_key = $is_first_setup ? strtoupper(bin2hex(random_bytes(8))) : $admin_key;
            $config  = [
                'group_name'         => $group_name,
                'epg_sources'        => $epg_sources,
                'allow_personal_epg' => $allow_personal_epg,
                'allow_personal_m3u' => $allow_personal_m3u,
                'admin_key'          => $new_key,
            ];
            $written = file_put_contents($config_path, json_encode($config, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
            if ($written === false) {
                $error = 'Cannot write config.json. Check permissions (chmod 775 .).';
            } else {
                $mode = 'success';
            }
        }
    }
    }
}

$prefill_group   = $_POST['group_name'] ?? $existing['group_name']     ?? '';
$prefill_sources = $existing['epg_sources']                            ?? [];
$prefill_epg     = !empty($existing['allow_personal_epg']);
$prefill_personal_m3u = array_key_exists('allow_personal_m3u', $existing)
    ? !empty($existing['allow_personal_m3u'])
    : $prefill_epg;
$submitted_key   = trim($_POST['admin_key_input'] ?? $_POST['admin_key_hidden'] ?? '');
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>GridTV — Setup</title>
<link rel="stylesheet" href="/assets/fonts/fonts.css">
<style>
  :root {
    --bg:#0a0b0d;--surface:#111318;--surface2:#181b22;
    --border:#232733;--border-bright:#2e3444;
    --accent:#e8c842;--accent2:#4a9eff;
    --text:#c8cdd8;--text-dim:#5a6070;--text-bright:#eef0f5;
    --error:#ff4444;--success:#44cc77;
  }
  *{box-sizing:border-box;margin:0;padding:0;}
  html,body{min-height:100%;background:var(--bg);color:var(--text);font-family:'Barlow Condensed',sans-serif;display:flex;align-items:flex-start;justify-content:center;}
  .setup-card{width:100%;max-width:580px;background:var(--surface);border:1px solid var(--border-bright);padding:40px 40px 36px;margin:40px 16px;}
  .setup-logo{font-family:'Share Tech Mono',monospace;font-size:22px;color:var(--accent);letter-spacing:.1em;text-transform:uppercase;margin-bottom:6px;}
  .setup-logo span{color:var(--text-dim);margin:0 6px;}
  .setup-subtitle{font-size:13px;color:var(--text-dim);letter-spacing:.05em;margin-bottom:32px;line-height:1.5;}
  .form-group{margin-bottom:22px;}
  .section-title{font-family:'Share Tech Mono',monospace;font-size:11px;letter-spacing:.12em;text-transform:uppercase;color:var(--accent);margin:32px 0 16px;padding-bottom:8px;border-bottom:1px solid var(--border);}
  label{display:block;font-size:11px;letter-spacing:.12em;text-transform:uppercase;color:var(--text-dim);margin-bottom:7px;font-family:'Share Tech Mono',monospace;}
  label .required{color:var(--accent);margin-left:3px;}
  label .optional{color:var(--text-dim);font-size:10px;text-transform:none;letter-spacing:0;margin-left:4px;opacity:.6;}
  input[type=text],input[type=url],input[type=password]{width:100%;background:var(--surface2);border:1px solid var(--border-bright);color:var(--text-bright);font-family:'Share Tech Mono',monospace;font-size:13px;padding:10px 12px;outline:none;transition:border-color .15s;}
  input:focus{border-color:var(--accent);}
  input::placeholder{color:var(--text-dim);opacity:.5;}
  .hint{font-size:11px;color:var(--text-dim);margin-top:5px;line-height:1.4;}
  .sources-list{display:flex;flex-direction:column;gap:16px;}
  .source-block{background:var(--surface2);border:1px solid var(--border);padding:16px;position:relative;}
  .source-block .source-num{font-family:'Share Tech Mono',monospace;font-size:10px;color:var(--accent);letter-spacing:.1em;margin-bottom:12px;}
  .source-fields{display:grid;gap:10px;}
  .source-remove{position:absolute;top:10px;right:10px;background:none;border:none;color:var(--text-dim);font-size:16px;cursor:pointer;line-height:1;padding:2px 5px;}
  .source-remove:hover{color:var(--error);}
  .btn-add-source{width:100%;background:none;border:1px dashed var(--border-bright);color:var(--accent2);font-family:'Barlow Condensed',sans-serif;font-size:13px;font-weight:600;letter-spacing:.1em;text-transform:uppercase;padding:10px;cursor:pointer;margin-top:8px;transition:border-color .15s,color .15s;}
  .btn-add-source:hover{border-color:var(--accent2);color:var(--text-bright);}
  .toggle-row{display:flex;align-items:center;justify-content:space-between;background:var(--surface2);border:1px solid var(--border);padding:14px 16px;margin-bottom:22px;}
  .toggle-label{font-size:13px;color:var(--text);line-height:1.4;}
  .toggle-label small{display:block;font-size:11px;color:var(--text-dim);margin-top:2px;}
  .toggle{position:relative;width:40px;height:22px;flex-shrink:0;margin-left:16px;}
  .toggle input{opacity:0;width:0;height:0;}
  .toggle-slider{position:absolute;inset:0;background:var(--border-bright);cursor:pointer;transition:background .2s;border-radius:22px;}
  .toggle-slider:before{content:'';position:absolute;width:16px;height:16px;left:3px;top:3px;background:var(--text-dim);transition:transform .2s,background .2s;border-radius:50%;}
  .toggle input:checked+.toggle-slider{background:var(--accent);}
  .toggle input:checked+.toggle-slider:before{transform:translateX(18px);background:#000;}
  .btn-submit{width:100%;background:var(--accent);color:#000;border:none;font-family:'Barlow Condensed',sans-serif;font-size:15px;font-weight:700;letter-spacing:.12em;text-transform:uppercase;padding:13px;cursor:pointer;margin-top:8px;transition:opacity .15s;}
  .btn-submit:hover{opacity:.85;}
  .alert{padding:12px 14px;font-size:13px;margin-bottom:24px;line-height:1.5;border-left:3px solid;}
  .alert-error{background:rgba(255,68,68,.08);border-color:var(--error);color:var(--error);}
  .alert-success{background:rgba(68,204,119,.08);border-color:var(--success);color:var(--success);}
  .success-actions{text-align:center;margin-top:28px;}
  .btn-go{display:inline-block;background:var(--accent);color:#000;font-family:'Barlow Condensed',sans-serif;font-size:16px;font-weight:700;letter-spacing:.12em;text-transform:uppercase;padding:13px 40px;text-decoration:none;transition:opacity .15s;}
  .btn-go:hover{opacity:.85;}
  .key-box{background:var(--surface2);border:1px solid var(--accent);padding:18px 20px;margin:24px 0;text-align:center;}
  .key-label{font-family:'Share Tech Mono',monospace;font-size:10px;letter-spacing:.12em;text-transform:uppercase;color:var(--text-dim);margin-bottom:10px;}
  .key-value{font-family:'Share Tech Mono',monospace;font-size:22px;color:var(--accent);letter-spacing:.15em;word-break:break-all;}
  .key-warning{font-size:11px;color:var(--text-dim);margin-top:10px;line-height:1.5;}
  .key-warning strong{color:var(--error);}
  .lock-screen{text-align:center;padding:10px 0 20px;}
  .lock-icon{font-size:36px;margin-bottom:16px;}
  .lock-title{font-family:'Share Tech Mono',monospace;font-size:13px;letter-spacing:.1em;color:var(--text);margin-bottom:8px;}
  .lock-sub{font-size:12px;color:var(--text-dim);margin-bottom:24px;line-height:1.5;}
  .lock-form{display:flex;gap:8px;}
  .lock-form input{flex:1;}
  .setup-note{margin-top:28px;padding-top:20px;border-top:1px solid var(--border);font-size:11px;color:var(--text-dim);line-height:1.6;}
  .setup-note code{font-family:'Share Tech Mono',monospace;background:var(--surface2);padding:1px 5px;border:1px solid var(--border);color:var(--accent2);font-size:11px;}
  .demo-banner{padding:12px 14px;font-size:13px;margin-bottom:24px;line-height:1.5;border-left:3px solid var(--accent2);background:rgba(74,158,255,.08);color:var(--text-bright);}
  .readonly-wrap{opacity:.82;}
  .readonly-hint{margin-top:12px;font-size:12px;color:var(--text-dim);line-height:1.5;}
</style>
</head>
<body>
<div class="setup-card">
  <div class="setup-logo">Grid<span>/</span>TV</div>

  <?php if ($demo_mode): ?>
    <div class="demo-banner">Demo mode is enabled on this instance. Visitors can view the current configuration, but saving changes is disabled.</div>
  <?php endif; ?>

  <?php if ($mode === 'lock'): ?>
    <div class="setup-subtitle">Enter your admin key to access the configuration.</div>
    <?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
    <div class="lock-screen">
      <div class="lock-icon">&#128274;</div>
      <div class="lock-title">Configuration locked</div>
      <div class="lock-sub">GridTV is already configured.<br>Enter your admin key to edit the settings.</div>
      <form method="POST" action="setup.php">
        <div class="lock-form">
          <input type="password" id="setupAdminKeyInput" name="admin_key_input" placeholder="Your admin key" autofocus autocomplete="off">
          <button type="submit" class="btn-submit" style="width:auto;padding:10px 20px;">Unlock</button>
        </div>
      </form>
    </div>

  <?php elseif ($mode === 'success'): ?>
    <div class="setup-subtitle">Configuration saved successfully.</div>
    <div class="alert alert-success">&#10003; Settings saved to <code>config.json</code>.</div>
    <?php if ($is_first_setup): ?>
    <div class="key-box">
      <div class="key-label">Your admin key</div>
      <div class="key-value"><?= htmlspecialchars($new_key) ?></div>
      <div class="key-warning"><strong>Save this key now.</strong> It will not be shown again.<br>You will need it to access this setup page in the future.</div>
    </div>
    <?php else: ?>
    <div class="alert alert-success" style="margin-top:0">Your admin key is unchanged.</div>
    <?php endif; ?>
    <div class="success-actions"><a href="index.php" class="btn-go">Open GridTV &rarr;</a></div>

  <?php else: ?>
    <div class="setup-subtitle">
      <?= $is_first_setup ? 'Welcome to GridTV. Fill in the fields below to get started.' : ($demo_mode ? 'View the current GridTV configuration.' : 'Edit your GridTV configuration.') ?>
    </div>
    <?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>

    <form method="POST" action="setup.php">
      <?php if (!$is_first_setup): ?>
        <input type="hidden" name="admin_key_hidden" value="<?= htmlspecialchars($submitted_key ?: $admin_key) ?>">
      <?php endif; ?>
      <?php if ($demo_mode): ?><div class="readonly-wrap"><fieldset disabled style="border:none;padding:0;margin:0"><?php endif; ?>

      <div class="form-group">
        <label>TV Group Name <span class="required">*</span></label>
        <input type="text" name="group_name" value="<?= htmlspecialchars($prefill_group) ?>" placeholder="e.g. JohnnyBeGood, MyTV, FamilyTV..." required>
        <div class="hint">Displayed top-left in the topbar.</div>
      </div>

      <div class="section-title">EPG Sources</div>
      <div class="sources-list" id="sourcesList">
        <?php
        $sources_to_show = !empty($prefill_sources) ? $prefill_sources : [['name'=>'Main','epg_url'=>'','m3u_url'=>'']];
        foreach ($sources_to_show as $i => $src): ?>
        <div class="source-block" data-index="<?= $i ?>">
          <div class="source-num">SOURCE <?= $i + 1 ?></div>
          <button type="button" class="source-remove" onclick="removeSource(this)"<?= count($sources_to_show) === 1 ? ' style="display:none"' : '' ?>>&#10005;</button>
          <div class="source-fields">
            <div>
              <label>Source name</label>
              <input type="text" name="source_name[]" value="<?= htmlspecialchars($src['name'] ?? '') ?>" placeholder="e.g. Main, Sports, Movies...">
            </div>
            <div>
              <label>EPG URL (XMLTV) <span class="required">*</span></label>
              <input type="url" name="source_epg_url[]" value="<?= htmlspecialchars($src['epg_url'] ?? '') ?>" placeholder="http://your-server/api/xmltv.xml">
            </div>
            <div>
              <label>M3U URL <span class="optional">(optional)</span></label>
              <input type="url" name="source_m3u_url[]" value="<?= htmlspecialchars($src['m3u_url'] ?? '') ?>" placeholder="http://your-server/api/channels.m3u">
              <div class="hint">Used by the built-in player to match channels to streams.</div>
            </div>
          </div>
        </div>
        <?php endforeach; ?>
      </div>
      <button type="button" class="btn-add-source" onclick="addSource()">+ Add EPG source</button>

      <div class="section-title">Options</div>
      <div class="toggle-row">
        <div class="toggle-label">
          Allow personal EPG
          <small>Visitors can use your instance with their own EPG/M3U URLs.</small>
        </div>
        <label class="toggle">
          <input type="checkbox" name="allow_personal_epg" id="allowPersonalEpg"<?= $prefill_epg ? ' checked' : '' ?>>
          <span class="toggle-slider"></span>
        </label>
      </div>

      <div class="toggle-row">
        <div class="toggle-label">
          Allow personal M3U
          <small>Lets visitors add their own stream playlist in the Personal EPG modal.</small>
        </div>
        <label class="toggle">
          <input type="checkbox" name="allow_personal_m3u" id="allowPersonalM3u"<?= $prefill_personal_m3u ? ' checked' : '' ?><?= !$prefill_epg ? ' disabled' : '' ?>>
          <span class="toggle-slider"></span>
        </label>
      </div>

      <?php if (!$demo_mode): ?>
      <button type="submit" class="btn-submit">Save configuration</button>
      <?php endif; ?>
      <?php if ($demo_mode): ?></fieldset></div><div class="readonly-hint">Saving is disabled in demo mode. Remove the <code>.demo</code> file on the server to restore normal editing.</div><?php endif; ?>
    </form>

  <?php endif; ?>

  <div class="setup-note">
    <strong>Note:</strong> Configuration is stored in <code>config.json</code> on the server.
    This file is excluded from the Git repository (<code>.gitignore</code>).
  </div>
</div>

<script>
let sourceCount = document.querySelectorAll('.source-block').length;
function addSource() {
  sourceCount++;
  const list = document.getElementById('sourcesList');
  const div  = document.createElement('div');
  div.className = 'source-block';
  div.innerHTML = `
    <div class="source-num">SOURCE ${sourceCount}</div>
    <button type="button" class="source-remove" onclick="removeSource(this)">&#10005;</button>
    <div class="source-fields">
      <div><label>Source name</label><input type="text" name="source_name[]" placeholder="e.g. Sports, Movies..."></div>
      <div><label>EPG URL (XMLTV) <span class="required">*</span></label><input type="url" name="source_epg_url[]" placeholder="http://your-server/api/xmltv.xml"></div>
      <div><label>M3U URL <span class="optional">(optional)</span></label><input type="url" name="source_m3u_url[]" placeholder="http://your-server/api/channels.m3u"><div class="hint">Used by the built-in player to match channels to streams.</div></div>
    </div>`;
  list.appendChild(div);
  updateRemoveButtons();
}
function removeSource(btn) { btn.closest('.source-block').remove(); renumberSources(); updateRemoveButtons(); }
function renumberSources() { document.querySelectorAll('.source-block').forEach((b,i) => b.querySelector('.source-num').textContent = `SOURCE ${i+1}`); }
function updateRemoveButtons() { const b = document.querySelectorAll('.source-block'); b.forEach(bl => bl.querySelector('.source-remove').style.display = b.length > 1 ? '' : 'none'); }
const allowPersonalEpgToggle = document.getElementById('allowPersonalEpg');
const allowPersonalM3uToggle = document.getElementById('allowPersonalM3u');
function syncPersonalM3uToggle() {
  if (!allowPersonalEpgToggle || !allowPersonalM3uToggle) return;
  allowPersonalM3uToggle.disabled = !allowPersonalEpgToggle.checked;
  if (!allowPersonalEpgToggle.checked) allowPersonalM3uToggle.checked = false;
}
allowPersonalEpgToggle?.addEventListener('change', syncPersonalM3uToggle);
syncPersonalM3uToggle();

const GRIDTV_ADMIN_KEY_STORAGE = 'gridtv-admin-key';
const setupAdminKeyInput = document.getElementById('setupAdminKeyInput');
const setupAdminHiddenInput = document.querySelector('input[name="admin_key_hidden"]');

try {
  const savedAdminKey = localStorage.getItem(GRIDTV_ADMIN_KEY_STORAGE) || '';
  if (setupAdminKeyInput && savedAdminKey) setupAdminKeyInput.value = savedAdminKey;
  if (setupAdminHiddenInput && savedAdminKey) setupAdminHiddenInput.value = savedAdminKey;
} catch (_) {}

if (setupAdminKeyInput?.form) {
  setupAdminKeyInput.form.addEventListener('submit', () => {
    try {
      localStorage.setItem(GRIDTV_ADMIN_KEY_STORAGE, setupAdminKeyInput.value.trim());
    } catch (_) {}
  });
}

if (setupAdminHiddenInput?.form) {
  const persistHiddenAdminKey = () => {
    try {
      const currentKey = setupAdminHiddenInput.value.trim();
      if (currentKey) localStorage.setItem(GRIDTV_ADMIN_KEY_STORAGE, currentKey);
    } catch (_) {}
  };
  persistHiddenAdminKey();
  setupAdminHiddenInput.form.addEventListener('submit', persistHiddenAdminKey);
}

<?php if ($mode === 'success' && !empty($new_key)): ?>
try {
  localStorage.setItem(GRIDTV_ADMIN_KEY_STORAGE, <?= json_encode($new_key) ?>);
} catch (_) {}
<?php endif; ?>
</script>
</body>
</html>